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Why We Need Network Analysis Tool? 
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HKMA promotes the application of surveillance technologies in AML / CFT 


Fintech 
Facilitation Office 


2016 


Smart Banking 
initiatives 


2017 


Banking Made 
Easy Initiative 


2018 
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Why We Need Network Analysis Tool? (Cont'd) 
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BOCHK is steadfast to fight against Group-wide Technology-based and 
money laundering Innovation-driven strategy 





Broaden the reach of intelligence-led 
investigations 
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Typical Transaction Monitoring System 





Identify any customer with red flag behavior 


that exceeds thresholds 





Examples of Red Flag Behavior 


» Transitional Transactions 
» Transactions Incommensurate with Customers' Profiles 
» Change of Transaction Pattern 


> High Volume Transactions 
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Typical Transaction Monitoring System (Cont'd) 





Using matrices plus advanced techniques 


e.g. machine learning, deep learning, Al 





Data Input Monitoring Matrices 


Scenario % Customer Segment 
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Typical Transaction Monitoring System (Cont'd) 





TT The behavior of one customer is assumed to be independent from 


that of another's in the identification process 





Examples 


» Single Customer to Multiple External Parties 
» Multiple External Parties to Single Customer 
» Single External Party to Multiple Customers 
» Multiple Customers to Single External Party 
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What Can Network Analysis Tool Do? 


Prevention & Early Detection 


Identify suspicious customers before 
conducting large transactions 


Connection 

Based on the connection among a 
„9 certain group of customers 
o 









group of users 


Shared Folder o, 
Able to share exported file among same e 
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Super STR 
Identify crime syndicate and collate all = 
information into one STR 


N 


Commonality 


Common static information or 
counterparts (e.g. testing payment) 
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Visualization Holistic Review 
Allow users to turn data into graphics Not only focus on a single customer 


> | 
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Application of Network Analysis Tool 





Application Situation 





Past suspicious cases Potential ML/fraud network 





Intelligence received from law enforcement unit Adverse news regarding crime syndicate 


Static Information — Email, phone, Internal Counterparty — Transfer 
address, employer, nationality transactions 


Customer Information E Transaction Counterparties 


External Counterparty — Wire 
Digital Footprint — IP, device token an 
transactions 


Commonality 
between 
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Application of Network Analysis Tool 





‘Bar Charts and Histograms’ function ‘Timeline Chart’ function 
» Displaying the value distributions in bar chart or » Displaying the transactions (which may belong to a 
histogram. group of people) in chronological order. 
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Case Example 1: Investigation of FMLIT Alert 


Background 


> In August 2020, FMLIT issued an alert stating that some newly opened accounts 
by Chinese customers were found to be stooge accounts 


» The accounts shared the same address or email 





» The names of the email account were meaningless character strings 


Action Taken 


» The Bank analyzed 328 accounts reported by the Bank in the past 6 months which held by Chinese customers 


> Looked for common static information from various aspects 
Investigation Result 
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328 Chinese | | | » STRs were submitted 
(Reported by the Same Employer (2 1 16 additional 
Bank from February ' Same Residential/Mailing Address: 3 | customers need » Related accounts were 


to August 2020) ENE further investigation terminated 
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Case Example 2: Analysis of Past STRs 





Two STR subjects were found to 
use the same email address. 
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Case Example 2: Analysis of Past STRs 
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& A 70-year-old retiree of the Bank 
transferred HK$9 million to two 
suspicious customers. 


Case Example 2: Analysis of Past STRs 
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Two STR subjects were found to 
use the same email address. 


A 70-year-old retiree of the Bank 
transferred HK$9 million to two 
suspicious customers. 

Source of funds was from same- 
named a/c of other banks. 
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Case Example 2: Analysis of Past STRs 





Two STR subjects were found to 
use the same email address. 
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The funds were later transferred to 
multiple personal accounts in other 
banks through remittance and FPS. 


Bank D account 
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Case Example 2: Analysis of Past STRs 





Two STR subjects were found to 
use the same email address. 
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A 70-year-old retiree of the Bank 
transferred HK$9 million to two 
suspicious customers. 






Source of funds was from same- 
named a/c of other banks. 
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8 The funds were later transferred to 
70 year-old Retiree multiple personal accounts in other 
Bank D account 


banks through remittance and FPS. 


The Bank immediately froze the 
accounts of two suspicious 
customers. 
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Vendor Selection 


Factors to consider: experience, system 


functions, operational efficiency, data security, 
AN system maintenance, implementation timeline 
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Challenges 
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Tool Specification 


Desktop version: Limited data access 


Server version: Huge setup and maintenance cost 
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Challenges 





Data Matters 


Customer Demographics + Connected 
Parties of Corporate Accounts + Transaction 
+ STR Filing Records + Digital Footprint 


System customization to 


Customer data and address users needs 


transaction data is 
extracted from a 
single database 
platform 


Group-wide policy to manage 
governance, ownership, quality 
and security 
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Challenges 





Tool Specification 


Factors to consider: experience, system 
functions, operational efficiency, data security, 
system maintenance, implementation timeline 


Desktop version: Limited data access 


Server version: Huge setup and maintenance cost 





Human Resources 
Customer Demographics + Connected 
Parties of Corporate Accounts + Transaction 
+ STR Filing Records + Digital Footprint 


Re-balance the manpower mix of simple review 
and complex analysis 


System customization to A dedicated team to handle 


Customer data and address users needs network analysis 


transaction data is 


A Group-wide policy to manage Deci licabl i 
single database p policy g ecide applicable scenario 


one governance, ownership, quality of the network analysis tool 


IT support — 
implementation & 


and security production 
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